You have several options for getting GPO details.
First, as you mentioned, you can leverage the Splunk App for Windows Infrastructure, that has several dashboards/reports available. This application requires installation the following supporting applications:
- Splunk Add-On for Active Directory (Installed on Splunk Search Head and AD DC Splunk Forwarder)
- Splunk Add-On for Microsoft DNS (Installed on Splunk Search Head and AD DC Splunk Forwarder)
- Splunk Add-On for Microsoft Windows (Installed on Splunk Search Head and AD DC Splunk Forwarder - *With atleast Security Eventlog Data input for GPO changes)
- Splunk Support Add-On for Active Directory (Installed on the Splunk Search Head Only)
Second option would be to use the MS Windows AD Objects (https://splunkbase.splunk.com/app/3177/) application which has numerous GPO dashboards/reports available. This app requires the following supporting add-ons:
- Splunk Add-On for Active Directory (Installed on Splunk Search Head and AD DC Splunk Forwarder)
- Splunk Add-On for Microsoft DNS (Installed on Splunk Search Head and AD DC Splunk Forwarder)
- Splunk Add-On for Microsoft Windows (Installed on Splunk Search Head and AD DC Splunk Forwarder - With atleast Security Eventlog Data input for GPO changes)
**Note:* The MS Windows AD Objects can also be integrated with the Splunk App for Windows Infrastructure app by replacing the Splunk Support Add-On for Active Directory (Remote LDAP Search) with local lookups. Documentation for doing this is located within the MS Windows AD Objects application UI menu.
Hope this helps.
... View more
